AUDIT UNDP COUNTRY OFFICE SOUTH AFRICA. Report No Issue Date: 22 September 2014 [REDACTED]

Transcription

1 UNITED NATIONS DEVELOPMENT PROGRAMME AUDIT OF UNDP COUNTRY OFFICE IN SOUTH AFRICA Report No Issue Date: 22 September 2014 [REDACTED]

2 Table of Contents Executive Summary i I. About the Office 1 II. Audit results 1 A. Governance and strategic management 1 B. United Nations system coordination 4 C. Programme activities 5 1. Programme management 5 2. Partnership and resource mobilization 6 3. Project management 6 D. Operations 8 1. Human resources 8 2. Financial management Procurement Information and communication technology Safety and security Asset management 16 Definitions of audit terms - ratings and priorities 18 Audit Report No. 1313, 18 September 2014: UNDP South Africa

3 Report on the audit of UNDP South Africa Executive Summary The UNDP (OAI) conducted an audit of UNDP South Africa (the Office) from 9 to 20 June The audit aimed to assess the adequacy and effectiveness of the governance, risk management and control processes relating to the following areas and sub-areas: (a) governance and strategic management (organizational structure and delegations of authority, leadership/ethics and values, risk management, planning, monitoring and reporting, financial sustainability); (b) United Nations system coordination (development activities, Resident Coordinator Office, Harmonized Approach to Cash Transfers); (c) programme activities (programme management, partnerships and resource mobilization, project management); and (d) operations (human resources, finance, procurement, information and communication technology, general administration, safety and security, asset management, leave management). The audit covered the activities of the Office from 1 January 2013 to 20 June The Office recorded programme and management expenditures totalling $16.5 million. The last audit of the Office was conducted by OAI in The audit was conducted in conformance with the International Standards for the Professional Practice of Internal Auditing. Overall audit rating OAI assessed the Office as partially satisfactory, which means, Internal controls, governance and risk management processes were generally established and functioning, but needed improvement. One or several issues were identified that may negatively affect the achievement of the objectives of the audited entity. This rating was mainly due to systemic weaknesses in governance and strategic management, United Nations system coordination, programme activities, and operations. Key recommendations: Total = 10, high priority = 5 For high (critical) priority recommendations, prompt action is required to ensure that UNDP is not exposed to high risks. Failure to take action could result in major negative consequences for UNDP. All high (critical) priority recommendations are presented below: Inadequate guidance and supervision on office governance (Issue 1) Management oversight and governance were inadequate, as the Office had not: (a) established a local internal control framework or formal delegations of authority for staff to define their roles and responsibilities; (b) developed action plans to address the persistent low Global Staff Survey ratings; (c) established terms of reference and standard operating procedures for the Development Solutions Team and the recently formed Programme Support Unit; or (d) exercised adequate monitoring and oversight of programme and project management and operations. Audit Report No. 1313, 22 September 2014: UNDP South Africa Page i

4 Recommendations: Strengthen existing internal controls and operating procedures by: (a) granting formal delegations of authority to office staff; (b) establishing a local internal control framework; (c) documenting formal action plans to address concerns highlighted in Global Staff Survey results; and (d) establishing clear terms of reference and standard operating procedures for the newly established Programme Support Unit and Development Solutions Team. Inadequate project management (Issue 4) Project management was inadequate, as local project appraisal committees were not convened, regular project board meetings were not held and there were weaknesses in project progress reports submitted to stakeholders. Project monitoring was also inadequate as there were limited field visits; risk and issue logs were not regularly updated and mitigated; and project financial statements were not reviewed. In addition, operationally completed projects were not financially closed within the established 12-month period. Recommendation: Strengthen project management processes by holding regular project board meetings, and improving project monitoring and reporting. Weaknesses in financial management (Issue 6) A total amount of $393,000 was paid to 23 different vendors, even though the original vendor invoices were not available. OAI noted that 20 budget overrides totalling $143,000 were performed by finance staff that did not have the delegated authority to do so. There were also weaknesses in making payments to implementing partners, as expenses were not validated by authorized personnel. Recommendation: Strengthen financial management controls and adhere to the Programme and Operations Policies and Procedures by: (a) processing payment vouchers based on original documents; (b) using the cheque writer software developed by UNDP; (c) establishing a policy for budget overrides, and ensuring that only designated authorized staff perform overrides; and (d) monitoring funds advanced to implementing partners and ensuring they are validated by authorized personnel. Weaknesses in procurement management (Issue 7) Procurement controls were inadequate as purchase orders and e-requisitions were not issued for all procurement actions, presenting the risk that liabilities for purchases were not fully recorded in Atlas (the enterprise resource planning system used by UNDP). Controls also needed to be improved in the recruitment of independent contractors as well as the sourcing of procurement vendors. Approximately 50 vendors in the database had duplicate bank accounts, and vendor performance was not evaluated. Recommendation: Enhance controls over procurement processes by: (a) ensuring the use of e-requisitions and purchase orders; (b) establishing a list of pre-vetted vendors and developing a consultant s roster to source independent consultants; (c) evaluating vendor performance; and (d) cleaning the vendor database. Audit Report No. 1313, 22 September 2014: UNDP South Africa Page ii

5

6 I. About the Office The Office, located in Pretoria, South Africa (the Country), at the time of the audit had 32 staff with fixed-term appointments and 9 other personnel who were either service contract holders or United Nations Volunteers. The Office developed the Country Programme Document, which had four main priority areas: (a) enhancing inclusive growth; (b) climate change and greening South Africa s economy; (c) strengthening democratic governance; and (d) support to South Africa s regional and global engagement. II. Audit results Satisfactory performance was noted in one area: General administration. Controls were generally well established and functioning adequately. OAI reviewed general administration activities, including common services, fuel management, vehicle management, and travel expense claims. A review of 30 local and international travel-related documents showed that travel management was carried out in accordance with the Programme and Operations Policies and Procedures. OAI made 10 recommendations ranked high (critical) and medium (important) priority. Low priority issues/recommendations were discussed directly and agreed with the Office and are not included in this report. High priority recommendations, arranged according to significance: (a) Strengthen existing internal controls and operating procedures (Recommendation 1). (b) Strengthen project management processes (Recommendation 4). (c) Enhance controls over procurement processes (Recommendation 7). (e) Strengthen financial management controls (Recommendation 6). Medium priority recommendations, arranged according to significance: (a) Strengthen programme management (Recommendation 3). (b) Improve controls over asset management (Recommendation 10). (c) Update the Office s Disaster Recovery Plan and ensure that it is tested (Recommendation 8). (d) Enhance controls over human resource management (Recommendation 5). (e) Fully implement the Harmonized Approach to Cash Transfers (Recommendation 2). The detailed assessment is presented below, per audit area: A. Governance and strategic management OAI reviewed the following four sub-areas in this section: (a) organizational structure and delegation of authority; (b) leadership/ethics and values; (c) risk management, planning and monitoring; and (d) financial sustainability of the Office. Shortcomings were noted, as described below: Issue 1 Inadequate guidance and supervision on office governance Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 1 of 18

7 (a) Incomplete delegations of authority The Programme and Operations Policies and Procedures require each head of office to establish adequate internal controls within the office, which include formal delegations of authority to define staff accountabilities. At the time of audit fieldwork, the Office had only established delegations of authority for the Country Director and the Deputy Country Director. The Office explained that it planned to delegate authority to the staff by the third quarter of The Office also had not established its own internal control framework to tailor the corporate Internal Control Framework to its own internal control procedures. For example, the Finance Associate, who did not have delegation of authority, was performing programme budget override functions and electronic fund transfers from the Office s bank accounts. The absence of a well-defined local internal control framework and delegations of authority may result in weak internal controls in the Office. (b) Actions to address Global Staff Survey results were not documented Since 2009, the Office s Global Staff Survey results consistently recorded lower scores than the global average. The 2013 Global Staff Survey, which was based on input from 15 respondents, resulted in low scores for all 11 dimensions, as the favorable responses ranged between 5 and 48 percent. Office management indicated that they had discussed the results with staff at the Office s retreat in May However, formal documented action plans to address these concerns had not been developed. The Office indicated that a working group comprising of senior management, the Staff Association, and the Human Resources Unit had been established, and that it had met twice to discuss action plans to address Global Staff Survey results. However, no further follow-up actions had been taken to address staff concerns. Failure to formally develop and implement an action plan to address the results of the Global Staff Survey could prevent the Office s management from monitoring the progress made in implementing this plan, which could further demotivate staff. (c) Inadequate standard operating procedures The Office restructured its Programme Unit and introduced a new organogram on 26 May 2014, which included the establishment of a Programme Support Unit in addition to the existing Development Solutions Team. The main objective of the Programme Support Unit was to support the Office s project management function. The existing Development Solutions Team continued to be responsible for the following programme thematic areas: (a) Governance; (b) Inclusive Growth; (c) Greening the Economy and Climate Change; and (d) South Africa s Global and Regional Role. As of the audit fieldwork date, clear terms of reference and standard operating procedures for these two units had not been established. This may result in confusion concerning roles and responsibilities that could in turn adversely impact the Office's productivity. Subsequent to the audit fieldwork, the Office indicated that the terms of reference for these two units had been prepared. (d) Inadequate controls over programme and operations Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 2 of 18

8 During the audit period, management did not adequately monitor and oversee programme and project management and office operations. Specifically, there was inadequate governance of projects and programme monitoring (refer to Issue Nos. 2-5). Also, several audit issues were noted in the areas of recruitment, procurement and financial management (refer to Issue Nos. 6-11). Some of the main causes of the deficiencies discussed above were the vacancies of several senior management positions for extended periods. For example, the Deputy Resident Representative (Programme) post had been vacant since the end of Although temporary arrangements were made to cover the long gaps, these were not effective due to a lack of continuity in guidance, direction and monitoring of work. OAI noted that all senior management positions had been filled since January OAI also noted that the Regional Bureau for Africa had been aware of these issues and had been supporting the Office's senior management in addressing these weaknesses. Subsequent to the audit, the Office s management team implemented some of the audit recommendations made in this audit report. Inadequate overall monitoring and oversight over programmes and projects may result in the Office failing to achieve its programmatic outcomes. Priority Recommendation 1: High (Critical) Strengthen existing internal controls and operating procedures by: (a) granting formal delegations of authority to office staff; (b) establishing a local internal control framework, taking into account local circumstances and the characteristics of its operations; (c) documenting action plans to address concerns highlighted in the Global Staff Survey results; and (d) establishing clear terms of reference and standard operating procedures for the Programme Support Unit and the Development Solutions Team. Management action plan: Subsequent to the audit fieldwork, the Office informed OAI that it had established formal delegations of authority to staff and documented an action plan to address concerns highlighted in the Global Staff Survey results. Furthermore, terms of reference for the Programme Support Unit and the Development Solutions Team had been completed. Estimated completion date: 31 December 2014 OAI Response OAI acknowledges the action taken by management; this will be reviewed at a later stage as part of the standard desk follow-up process of OAI. Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 3 of 18

9 B. United Nations system coordination OAI reviewed the United Nations Resident Coordination Office, its coordination function, annual reports submitted to the United Nations Development Operations Coordination Office, minutes of United Nations Country Team meetings, joint initiatives undertaken, and implementation of the Harmonized Approach to Cash Transfers. One issue was noted, as discussed below: Issue 2 Harmonized Approach To Cash Transfers not fully implemented To lessen the burden that the multiplicity of United Nations procedures and rules creates for its partners, the Framework for Harmonized Approach to Cash Transfers to Implementing Partners requires that participating United Nations agencies (UNDP, UNICEF and UNFPA) agree on and coordinate Harmonized Approach to Cash Transfer activities. Compliance is achieved when the following four steps have been completed: (a) macroassessment of the public financial system; (b) micro-assessments of implementing partners; (c) agreement with the Government on implementing the Harmonized Approach to Cash Transfers; and (d) development and implementation of an assurance and audit plan for implementing partners. The Office had initiated actions with UNICEF and UNFPA from 2009 up to 2012 to implement the Harmonized Approach to Cash Transfers. However, the Office had neither completed the macro-assessment of the public financial system nor conducted formal micro-assessments of any implementing partners during the programme cycle. Consequently, the Office was not in a position to prepare the required assurance plan during the audit period. A Harmonized Approach to Cash Transfers working group and a detailed implementation plan to guide efficient implementation of the harmonized approach had yet to be prepared at the time of audit. The Office indicated that senior management vacancies resulted in the lack of follow-through to fully implement the Harmonized Approach to Cash Transfers. Management assured OAI that it would prioritize implementation by the end of In the absence of a formal working group and an implementation plan, there is a risk that implementation of the Harmonized Approach to Cash Transfers will be delayed due to the lack of coordination and follow up actions by all relevant agencies. Priority Recommendation 2: Medium (Important) Fully implement the Harmonized Approach to Cash Transfers by: (a) completing a macro-assessment of the public financial system followed by micro-assessments of implementing partners; (b) establishing a formal working group and developing an implementation plan; and (c) establishing assurance plans and conducting assurance activities. Management action plan: The Office indicated that macro- and micro-assessments will be completed by mid In the meantime, a formal Harmonized Approach to Cash Transfers working group has been established and an implementation plan will be finalized by 30 November Estimated completion date: 30 June 2015 Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 4 of 18

10 OAI Response OAI acknowledges the action taken by management; this will be reviewed at a later stage as part of the standard desk follow-up process of OAI. C. Programme activities 1. Programme management OAI reviewed the Country Programme Document and its alignment with the Strategic Framework and the Country Programme Action Plan that was signed on March The following issue was noted: Issue 3 Programme monitoring and evaluation framework not developed The Programme and Operations Policies and Procedures state that all outcomes to which UNDP is contributing must be monitored and evaluated regularly. This includes the development of a programme monitoring and evaluation framework to enable the monitoring and evaluation of UNDP s programmatic interventions. The annual review of the Country Programme Action Plan is a key part of this monitoring activity. Although the new Country Programme cycle began in January 2013, the Office had not developed a programme monitoring and evaluation framework, and had not conducted an annual review of the Country Programme Action Plan for This review would have provided opportunities to consider challenges, new partnerships and opportunities to make revisions in the Country Programme Action Plan. The main government counterpart indicated that it preferred that the Office conduct an annual review of the Plan. The absence of a programme monitoring and evaluation framework creates the risk that the Office may not be able to monitor and evaluate UNDP s overall programmatic interventions in the Country and make improvements where needed. Priority Recommendation 3: Medium (Important) Strengthen programme management by formulating and implementing a comprehensive programme monitoring and evaluation framework, and conducting an annual review of the Country Programme Action Plan. Management action plan: The Office informed OAI that subsequent to the audit fieldwork, a monitoring and evaluation plan was finalized for the period 2013 to 2017, and it planned to conduct the Country Programme Action Plan review within the overall United Nations Strategic Cooperation Framework review with the Government. Estimated completion date: Ongoing Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 5 of 18

11 OAI Response OAI acknowledges the action taken by management; this will be reviewed at a later stage as part of the standard desk follow-up process of OAI. 2. Partnership and resource mobilization The Office estimated total programme expenditure of $55.7 million for its Country Programme Action Plan The Global Environment Facility Fund was forecasted to represent $33.9 million (or 61 percent of total estimated programme resources). The Office did not have a documented resource mobilization strategy; however, it indicated that it had projects amounting to $30.4 million funded by the Global Environment Facility Fund up to The Office explained that it had been exploring other sources of programme funding, such as the private sector, to enlarge its programme funding pool. Discussions with the main government counterpart and other partners indicated good working relationships with the Office. 3. Project management From January 2013 to June 2014, total project expenditures totalled $12 million. The Office had 21 projects, all of which were nationally implemented. OAI reviewed a sample of 10 projects with cumulative expenditures of $10 million. Issue 4 Inadequate project management OAI noted that the Global Environment Facility funded projects were generally well-managed, but the following weaknesses were noted in other projects: (a) Lack of formal project appraisals The Programme and Operations Policies and Procedures require the convening of project appraisal committees at the stage of defining the project to review and appraise the project scope, the results and resources framework and the project management arrangements. There was no documented evidence that local project appraisal committees were convened to formally appraise the 10 projects that OAI reviewed ( , , , , , , , , and ). When local project appraisal committees do not appraise projects, the stakeholders participation is limited and lessons learned are not taken into account in the project design. (b) Inadequate project oversight The Programme and Operations Policies and Procedures require at least one project board meeting to be held annually for each project to exercise oversight and overall governance of the project. The actual frequency depends on risks involved, project complexity and the project board members. However, for six projects ( , , , , and ), no meetings were held during 2013 and Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 6 of 18

12 OAI noted from the project board meeting minutes that in many cases the above substantive matters were not discussed to address challenges that impacted the project. For example, Project Nos and experienced delays, but these delays were not discussed in project board meetings and action plans to mitigate these delays were not deliberated. Furthermore, minutes of project board meetings did not include a list of attendees and the minutes were not signed. Also, the Office s programme staff did not always attend these meetings, as they were reportedly busy attending to other duties. (c) Weaknesses in project progress reports The Programme and Operations Policies and Procedures stipulate that project progress reports should provide analysis of project performance over the reporting period. There were weaknesses in project progress reports submitted to stakeholders. For five projects, progress reports were not prepared ( , , , and ). For the remaining five projects reviewed, the progress reports were generally activity-based and did not necessarily report at the output and outcome levels. As such, it may have been difficult to assess the progress made towards achieving project outputs and outcomes. Further, there was no documentation that these reports had been reviewed by the Office s programme staff and approved by senior management. The inadequate oversight may result in inaccurate data/information being included in progress reports. (d) Inadequate project monitoring The Programme and Operations Policies and Procedures recommend various tools for monitoring projects. Overall project monitoring was inadequate, as indicated below: some of the projects did not maintain risk logs and issue logs in Atlas (Project Nos , and 76680); and the evaluations and audit recommendations pertaining to all projects reviewed were not monitored effectively. (e) Absence of an annual work plan Five projects (84812, 84811, 84810, 84807, and 84813) with a cumulative budget of $2.1 million for 2013 and 2014 that had multiple implementing partners did not have annual work plans for 2013 and Without an annual work plan, it is difficult to monitor the progress made toward achieving project outputs and linking project resources to clearly identifiable deliverables. (f) Inadequate capacity assessments of implementing partners The Programme and Operations Policies and Procedures require that the capacity of potential implementing partners be assessed. For 10 projects reviewed, the implementing partner selection process, including identification and the capacity assessments, were not carried out (Project Nos , , , , , , , , and ). Without capacity assessments, the Office may not be able to determine the risks involved in working with the implementing partner and the measures that need to be taken to mitigate those risks. (g) Delay in closure of projects in Atlas Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 7 of 18

13 The Programme and Operations Policies and Procedures require projects to be operationally closed once activities have been implemented. The operationally closed projects should then be financially closed within one year of operational closure. According to Atlas, the Office had 198 active projects. Of these, 26 were operationally closed for more than 12 months during the period from 2003 to 2012, but had not been financially closed yet. Further, 45 other projects were identified as ongoing in Atlas, although their activities ended between 2004 and The Office was in the process of identifying the status of the remaining 106 projects which were no longer operationally active. The Office indicated that it was working to close the projects that were no longer operational. Weak project management may result in projects failing to achieve their intended objectives. Priority Recommendation 4: High (Critical) Strengthen project management processes by: (a) having local project appraisal committees appraise new projects prior to their approval; (b) holding regular project board meetings, conducting regular project field visits, updating project risks, monitoring evaluation results and audit recommendations, and developing annual work plans for projects; (c) conducting and reviewing capacity assessments of potential implementing partners for all future projects; and (d) financially closing all projects in Atlas which are operationally completed within 12 months, and updating the status of projects in Atlas. Management action plan: The Office indicated that it will establish local project appraisal committees for all new projects and perform capacity assessments for all new partnerships with implementing partners and responsible parties. It further commented that project monitoring and performance would be enhanced and necessary actions would be undertaken to close completed projects in Atlas. Estimated completion date: 31 December 2014 D. Operations 1. Human resources As of June 2014, the Operations Support Unit was responsible for human resource activities. However, the Unit had two dedicated General Service posts (at the GS7 and the GS5 levels), although the GS5 post was vacant. OAI reviewed all major human resource processes, including distribution of tasks, recruitment, separation, performance management, learning, salary payments and local benefits payments. Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 8 of 18

14 Issue 5 Weaknesses in human resource management OAI noted a number of weaknesses, as stated below. (a) Inadequate controls over recruitment: According to the UNDP Recruitment and Selection Framework, UNDP s recruitment processes are guided by the principles of competition, objectivity, transparency, diversity and accountability. OAI reviewed all five fixed-term and service contract recruitments during the audit period and noted that they did not comply with applicable criteria, as highlighted below: documents justifying decisions taken for long-listing, short-listing and selecting candidates were not available in three cases; the recruitment of one individual was solely based on a curriculum vitae that was provided by the national implementing partner. There was no competitive selection process and no documented justification for this action. This recruitment was carried out by using a service contract for the position of Project Manager, Global Environmental Facility; in two cases, there was no evidence to support that reference checks had been duly conducted; and the minimum required advertisement duration of one week was reduced to four days in one recruitment case. According to the Office, this was done to hasten the recruitment process, although the justification for hastening the process was not available. The Office was not using UNDP s corporate recruitment management website at the time of the audit fieldwork. However, management stated that the Office started using the website immediately after the completion of audit fieldwork. (b) Inadequate justification for salary advances: United Nations Staff Rule 3.15 limits salary advance payments to exceptional and compelling circumstances. At the time of the audit, the Office had outstanding salary advances of $40,000 made to 21 staff. A review of 10 of these advances revealed that they were provided for children s tuition, home safety improvements and vehicle repairs, none of which fall into the category of exceptional and compelling circumstances. The Office indicated that making such advances has been a long-standing practice, but acknowledged that in most instances, these did not comply with the United Nations staff rules. (c) Mandatory courses not completed: According to the Programme and Operations Policies and Procedures, all staff are required to complete six mandatory courses that are important for understanding the policies and objectives of the organization. At the time of the audit, 30 of the 33 personnel (91 percent) had not completed all the mandatory courses. (d) Performance assessments not completed in a timely manner: The Programme and Operations Policies and Procedures require staff members and their supervisors to complete an annual staff performance assessment. As of the audit date, 27 staff had not completed their performance assessments for 2013, even though the deadline was February Weak management of human resources may hinder the capacity of the Office to achieve its objectives. Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 9 of 18

15 Priority Medium (Important) Recommendation 5: Enhance controls over human resource management by: (a) documenting decisions made throughout the recruitment process, including non-competitive recruitment cases, conducting systematic reference checks and adhering to the required advertisement periods; (b) reducing the number of salary advances and limiting them to exceptional and compelling circumstances, as required by the United Nations Staff Rules; (c) ensuring all personnel complete UNDP mandatory training within the specified six-month time frame; and (d) completing the 2013 performance assessments as soon as possible and ensuring future assessments are completed within the deadline. Management action plan: The Office indicated that: (a) For all the recruitments conducted in 2014, decisions and processes have been documented. All of them were competitive. Reference checks are on file for recommended candidates. (b) While the financial risk to UNDP is fully controlled through automatic deductions before 31 December of each year, the Office will control emergency salary advances in compliance with staff rules. (c) Mandatory trainings for all remaining staff will be completed by end (d) All performance assessments for 2013 have been completed with the exception of three staff members. Estimated completion date: 31 December 2014 OAI Response OAI acknowledges the action taken by management; this will be reviewed at a later stage as part of the standard desk follow-up process of OAI. 2. Financial management OAI reviewed 160 regular payment vouchers and 11 other vouchers related to cash advances to nationally implemented projects with a cumulative value of $3.6 million, or 23 percent of all vouchers paid during the audit period. OAI also reviewed the disbursement process and bank reconciliations for the period from July 2013 to March The Finance Unit was staffed by two General Service staff members who reported to the Deputy Country Director for Operations. Issue 6 Weaknesses in financial management According to the UNDP Financial Regulations and Rules, payments should be made on the basis of supporting documents and by ensuring that services or goods have been received, and that they had not been paid for Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 10 of 18

16 previously. The Programme and Operations Policies and Procedures require reporting expenses relating to advance payments made for nationally implemented projects at least quarterly and that the reports be signed by the authorized implementing partner responsible for these advances. OAI s review identified the following weaknesses: (a) Inadequate controls over payments: Payments were made to 23 vendors amounting to $393,000 without original vendor invoices. The Office also regularly made payments based on copies of invoices received through s or hard copies. In 13 cases amounting to $90,000, there was no documented receipt of goods or services. Incorrect account codes were noted in 10 payment vouchers amounting to $100,000. According to the UNDP Internal Control Framework, UNDP offices are required to ensure that cheque writer software is used to generate cheques. However, the Office did not use the software developed by UNDP, but instead prepared cheques manually, which could expose the Office to risk of fraud. (b) Unauthorized budget overrides: The Programme and Operations Policies and Procedures require UNDP Offices to establish a policy that outlines the circumstances under which a budget override is acceptable and to designate staff authorized to override budget exceptions. OAI noted that 20 budget overrides totalling $143,000 during the audit period were performed by finance staff that did not have the delegated authority. (c) Funding Authorization and Certification of Expenses forms: OAI reviewed a sample of 11 Funding Authorization and Certification of Expenses (FACE) forms for advance payments made to nationally implemented projects totalling $1.9 million (or 17 percent of all advances). The review showed that there was inadequate documentation for requests received from implementing partners. In addition, OAI noted the following: The FACE forms reviewed were not approved by the Programme Officer and hence there was no assurance that expenditures reported in the forms were in line with the project work plans. Moreover, four of the FACE forms were not signed by the authorized Project Manager. All 11 FACE forms reviewed were processed by the Office based on copies of forms and not originals. The Office was unable to provide three FACE forms amounting to $0.5 million for OAI review. As of 31 March 2014, advances of $42,000 to implementing partners were outstanding for more than six months. The above control weaknesses were due mainly to inadequate oversight and monitoring by the Finance Unit. There is a risk that ineligible payments may occur if payment vouchers are raised without sufficient supporting documents. Also, the absence of a budget override policy and inadequate management of advances to projects may result in financial losses for UNDP. Priority High (Critical) Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 11 of 18

17 Recommendation 6: Strengthen financial management controls and adhere to the Programme and Operations Policies and Procedures by: (a) processing payment vouchers based on complete supporting documents, original invoices, and confirmation of receipts for goods and services; (b) using the cheque writer software developed by UNDP to write cheques; (c) establishing a policy for budget overrides based on the Internal Control Framework if warranted and, ensuring overrides are performed by designated authorized staff; and (d) monitoring funds advanced to implementing partners by ensuring that only original Funding Authorization and Certification of Expenses forms are processed, signed by the authorized Project Manager and reviewed and cleared by the respective Programme Officers. Management action plan: The Office indicated that: (a) Instructions have been issued to staff to ensure that relevant documents such as original invoices, confirmation of receipts for goods are attached before processing payment vouchers. (b) The cheque writer has been installed and configured and is being tested. (c) The override policy has been established, communicated to all staff and is fully implemented. (d) Instructions have been given to implementing partners to send original FACE forms certified by authorized signatories. Estimated completion date: end September OAI Response OAI acknowledges the action taken by management; this will be reviewed at a later stage as part of the standard desk follow-up process of OAI. 3. Procurement As of June 2014, two General Service posts (at the GS6 and the GS5 levels) were dedicated to procurement, of which the GS6 post was vacant. A total of 6,700 purchase orders were issued during the audit period, resulting in procurement of $2.4 million. Issue 7 Weaknesses in procurement management OAI noted the following weaknesses in the procurement function: (a) Inadequate procurement planning: The Programme and Operations Policies and Procedures require that procurement activities be planned to assist in obtaining best value for money. The Office did not have a plan to guide its procurement activities, but indicated that it was developing such a plan. The Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 12 of 18

18 absence of a comprehensive and up-to-date procurement plan may result in procurement processes being conducted hastily, which might preclude the Office from obtaining best value for money. (b) Inadequate controls over procurement: Requisitions and the correct use of purchase orders are important elements of the procurement processes. OAI noted that the Office had implemented e- requisitions in 2013 (electronic requests for procurement initiated through the Atlas system). However, during the audit period, only about 50 percent of purchase orders were triggered by an e-requisition. Throughout the audit period, the Office had not used purchase orders systematically for all procurement activities. This constitutes a risk that liabilities for purchases are not fully recorded in Atlas. (c) Procurement process shortcomings: OAI reviewed a sample of 15 purchase orders valued at $544,000 (23 percent of the purchase orders issued during the audit period) and 18 individual contractor cases amounting to $520,000 and noted the following weaknesses: The recruitment of two individual contractors was solely based on curriculum vitaes that were provided by the national implementing partner. There was no competitive selection process and no documented justification for this action. The Office was aware of these instances and had already sent a letter to the implementing partners explaining the contracting process. The Office was not able to provide key documents, such as sourcing and evaluation documents, related to procurement processes for one supplier and three consultants (total purchase order value for these cases amounted to $130,000). In three other cases, OAI was not able to identify the pre-screening criteria used by the Office to contact potential candidates. In two cases, one or more pre-screened candidates did not meet the minimum requirements of the corresponding consultancy. OAI noted that the Office s market research for local procurement was not well-documented. As such, OAI had difficulties in reconstructing how companies providing services such as printing were sourced by the Office. OAI further noted that in a number of cases, sourcing was not done by the procurement staff, but rather by other units such as communications and/or programme staff. Public tenders advertised by the Office listed the name of the responsible staff member as a contact person. Further, one staff member was given exclusive access to all offers submitted via to the Office. Such arrangements increase the risks of breaches in the confidentiality of the offers received, of tampering in the proposals received, and/or collusion with vendors. OAI noted systemic weaknesses in the evaluation of offers and proposals. For example, in two cases, the disqualification of offerors was not well-justified or documented. In three sampled purchase orders, there were significant differences in the scores awarded by individual evaluators, pointing to a lack of common understanding of the evaluation criteria and or clarity in the terms of reference. OAI also noted a number of cases with significant, but unanalysed price differences among bidders, which also pointed to a possible lack of clarity in the terms of reference. (d) Vendor management: OAI s review of the vendor database and the vendor registration process identified 50 vendors with duplicate bank accounts. In addition, the database contained numerous misspellings and incorrect vendor names. Further, the Office only requested a bank confirmation of Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 13 of 18

19 account ownership in order to register a vendor in the Office s database (Atlas) even though some banks in South Africa do not require detailed information about the vendors when opening bank accounts. The Office did not conduct any vendor performance evaluations for suppliers or individual contractors. These vendor management weaknesses constitute deficiencies that could lead to the increased risk of fraud. By not properly managing the procurement function, the Office may not achieve its objectives and may be exposed to an increased risk of fraud. Priority Recommendation 7: High (Critical) Enhance controls over procurement processes by: (a) developing and implementing a procurement plan and complying with UNDP corporate requirements such as using e-requisitions and purchase orders; (b) establishing a list of pre-vetted vendors for purchases that the Office undertakes as well as developing a consultant s roster to source individual contractors and enhance controls when receiving electronic bids; (c) holding pre-evaluation meetings to ensure evaluators have a common understanding of the evaluation criteria, the terms of reference and/or specifications; (d) cleaning the vendor database of duplications and misspellings, and reviewing the processes for vendor registration as well as evaluating vendor performance. At a minimum, the process for vendor registration should include steps to obtain assurance that the new vendor actually exists and to ensure that the vendor has not been previously entered into the database. Management action plan: The Office indicated that: (a) The procurement plan is completed. (b) A list of pre-vetted vendors and a roster of consultants will be developed. (c) Pre-evaluation meetings will be organized for all new complex procurements. (d) The vendor database cleaning has been completed and controls over vendor registration have been enhanced. Estimated completion date: June OAI Response OAI acknowledges the action taken by management; this will be reviewed at a later stage as part of the standard desk follow-up process of OAI. 4. Information and communication technology Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 14 of 18

20 OAI s review of information and communication technology included software and hardware management, back-up and restoration arrangements, site visits to the Office s servers and the latest available Disaster Recovery Plan. One issue noted is discussed below. Issue 8 Outdated Disaster Recovery Plan The Programme and Operations Policies and Procedures require that offices have a Disaster Recovery Plan to minimize interruption and downtime in case of an emergency incident. The Office had not updated its plan since 2009, but the Office indicated that it was currently working on a new plan. The absence of a Disaster Recovery Plan may expose the Office to losses and/or extended downtime in cases of emergency, and extra costs to the organization. Priority Recommendation 8: Medium (Important) Update the Office s Disaster Recovery Plan and ensure it is tested after validation by the UNDP Office of Information Systems and Technology. Management action plan: Subsequent to the audit fieldwork, the Office updated the Disaster Recovery Plan. Estimated completion date: Done OAI Response OAI acknowledges the action taken by management; this will be reviewed at a later stage as part of the standard desk follow-up process of OAI. 5. Safety and security [NOTE: This section has been redacted as it is deemed to contain sensitive information.] Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 15 of 18

21 6. Asset management At the end of December 2013, the Office reported 67 capital assets in the system amounting to $302,000. OAI reviewed how the Office accounted for its capital and non-capital assets and physically verified a sample of these assets. Issue 10 Inadequate management of office assets The UNDP Financial Regulations and Rules require the maintenance of accurate and up-to-date asset records. OAI's review of asset management disclosed the following shortcomings: The Office used an inaccurate report for physically verifying its assets at the end of This report reflected only 67 items out of the 82 items recorded in Atlas. As a result, there was no assurance that the physical verification team had been able to accurately detect discrepancies. A heavy duty photocopier was installed in the Office, but not included in the Atlas asset report. The value of this machine was not provided by the Office. Two other heavy duty photocopiers were not functioning or used by the Office. However, they were still listed as assets in Atlas. Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 16 of 18

22 Additionally, the Office reported eight capital assets valued at $14,287 included in Atlas at the end of December 2013, but they were not physically verified. The Office did not explain this discrepancy, but indicated that corrective actions would be taken. The inadequate management increased the risk of the misuse or loss of office assets. Priority Medium (Important) Recommendation 10: Improve controls over asset management by maintaining a complete, accurate and up to date list of assets, and periodically conducting a physical verification of all assets against a current list of assets in the Atlas system. Management action plan: The Office indicated that subsequent to the audit, all assets had been verified and the asset list had been updated. Estimated completion date: Done OAI Response OAI acknowledges the action taken by management; this will be reviewed at a later stage as part of the standard desk follow-up process of OAI. Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 17 of 18

23 Definitions of audit terms - ratings and priorities A. AUDIT RATINGS Satisfactory Internal controls, governance and risk management processes were adequately established and functioning well. No issues were identified that would significantly affect the achievement of the objectives of the audited entity. Partially Satisfactory Internal controls, governance and risk management processes were generally established and functioning, but needed improvement. One or several issues were identified that may negatively affect the achievement of the objectives of the audited entity. Unsatisfactory Internal controls, governance and risk management processes were either not established or not functioning well. The issues were such that the achievement of the overall objectives of the audited entity could be seriously compromised. B. PRIORITIES OF AUDIT RECOMMENDATIONS High (Critical) Prompt action is required to ensure that UNDP is not exposed to high risks. Failure to take action could result in major negative consequences for UNDP. Medium (Important) Action is required to ensure that UNDP is not exposed to risks that are considered moderate. Failure to take action could contribute to negative consequences for UNDP. Low Action is desirable and should result in enhanced control or better value for money. Low priority recommendations, if any, are dealt with by the audit team directly with the Office management, either during the exit meeting or through a separate memo subsequent to the fieldwork. Therefore, low priority recommendations are not included in this report. Audit Report No. 1313, 22 September 2014: UNDP South Africa Page 18 of 18